<!DOCTYPE html>
<html lang="en">
  <head>
    <link rel="stylesheet" type="text/css" href="/css/style.css?v=18" />
    <link rel="stylesheet" type="text/css" href="/css/fontello.css?v=2" />
    <link rel="stylesheet" type="text/css" href="/css/themes/nitter.css" />
    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png" />
    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png" />
    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png" />
    <link rel="manifest" href="/site.webmanifest" />
    <link rel="mask-icon" href="/safari-pinned-tab.svg" color="#ff6c60" />
    <link rel="search" type="application/opensearchdescription+xml" title="nitter" href="https://nitter.net/opensearch" />
    <link rel="canonical" href="https://twitter.com/CraigHRowland/status/1628883826738077696" />
    <title>Craig Rowland - Agentless Linux Security (@CraigHRowland): &quot;A tainted Linux kernel can reveal a stealth rootkits if you know how to look for it. I&#x27;ll show you some basics in this thread about how it works. 

It all starts with: 

cat &#x2F;proc&#x2F;sys&#x2F;kernel&#x2F;tainted&quot; | nitter</title>
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
    <meta name="theme-color" content="#1F1F1F" />
    <meta property="og:type" content="photo" />
    <meta property="og:title" content="Craig Rowland - Agentless Linux Security (@CraigHRowland)" />
    <meta property="og:description" content="A tainted Linux kernel can reveal a stealth rootkits if you know how to look for it. I'll show you some basics in this thread about how it works. 

It all starts with: 

cat /proc/sys/kernel/tainted" />
    <meta property="og:site_name" content="Nitter" />
    <meta property="og:locale" content="en_US" />
    <link rel="preload" type="image/png" href="/pic/media%2FFprwnLWaMAEvYI9.jpg%3Fname%3Dsmall%26format%3Dwebp" as="image" />
    <meta property="og:image" content="https://nitter.net/pic/media%2FFprwnLWaMAEvYI9.jpg" />
    <meta property="twitter:image:src" content="https://nitter.net/pic/media%2FFprwnLWaMAEvYI9.jpg" />
    <meta property="twitter:card" content="summary_large_image" />
    <link rel="preload" type="font/woff2" as="font" href="/fonts/fontello.woff2?21002321" crossorigin="anonymous" />
  </head>
  <body>
    <nav><div class="inner-nav">
        <div class="nav-item"><a class="site-name" href="/">nitter</a></div>
        <a href="/"><img class="site-logo" src="/logo.png" alt="Logo" /></a>
        <div class="nav-item right">
          <div class="icon-container"><a class="icon-search" title="Search" href="/search"></a></div>
          <div class="icon-container"><a class="icon-bird" title="Open in Twitter" href="https://twitter.com/CraigHRowland/status/1628883826738077696"></a></div>
          <a href="https://liberapay.com/zedeus"><svg class="lp" viewBox="0 0 40.6 52.3">
  <g transform="matrix(0.83,0,0,0.83,-158,-261)">
    <path d="m202.5,366c-3.1 0-5.5-0.4-7.3-1.2-1.8-0.8-3-1.9-3.8-3.3-0.8-1.4-1.1-3-1.1-4.8 0-1.8 0.3-3.7 0.8-5.8l8.3-34.8 10.2-1.6-9.1 37.8c-0.2 0.8-0.3 1.5-0.3 2.2 0 0.7 0.1 1.2 0.4 1.7 0.3 0.5 0.7 0.9 1.3 1.2 0.6 0.3 1.5 0.5 2.7 0.6l-2 8.1"/>
    <path d="m239.2 344.3c0 3.2-0.5 6.1-1.6 8.8-1 2.6-2.5 4.9-4.4 6.9-1.9 1.9-4.1 3.4-6.7 4.5-2.6 1.1-5.4 1.6-8.5 1.6-1.5 0-3-0.1-4.5-0.4l-3 11.9h-9.7l10.9-45.4c1.7-0.5 3.7-1 6-1.4 2.3-0.4 4.7-0.6 7.3-0.6 2.4 0 4.6 0.4 6.3 1.1 1.8 0.7 3.2 1.8 4.4 3 1.1 1.3 2 2.8 2.5 4.5 0.5 1.7 0.8 3.6 0.8 5.5m-23.8 13.4c0.7 0.2 1.7 0.3 2.8 0.3 1.7 0 3.3-0.3 4.7-1 1.4-0.6 2.6-1.5 3.6-2.7 1-1.1 1.7-2.5 2.3-4.1 0.5-1.6 0.8-3.4 0.8-5.3 0-1.9-0.4-3.5-1.2-4.8-0.8-1.3-2.3-2-4.3-2-1.4 0-2.7 0.1-3.9 0.4l-4.6 19.1"/>
  </g>
</svg>
</a>
          <div class="icon-container"><a class="icon-info" title="About" href="/about"></a></div>
          <div class="icon-container"><a class="icon-cog" title="Preferences" href="/settings?referer=%2FCraigHRowland%2Fstatus%2F1628883826738077696%23m"></a></div>
        </div>
      </div></nav>
    <div class="container"><div class="conversation">
        <div class="main-thread">
          <div id="m" class="main-tweet"><div class="timeline-item thread thread-line"><div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/CraigHRowland"><img class="avatar round" src="/pic/profile_images%2F1533597714381803520%2F9-0dOYFp_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/CraigHRowland" title="Craig Rowland - Agentless Linux Security">Craig Rowland - Agentless Linux Security</a>
                        <a class="username" href="/CraigHRowland" title="@CraigHRowland">@CraigHRowland</a>
                      </div>
                      <span class="tweet-date"><a href="/CraigHRowland/status/1628883826738077696#m" title="Feb 23, 2023 · 10:25 PM UTC">Feb 23</a></span>
                    </div>
                  </div></div>
                <div class="tweet-content media-body" dir="auto">A tainted Linux kernel can reveal a stealth rootkits if you know how to look for it. I'll show you some basics in this thread about how it works. 

It all starts with: 

cat /proc/sys/kernel/tainted</div>
                <div class="attachments"><div class="gallery-row" style=""><div class="attachment image"><a class="still-image" href="/pic/orig/media%2FFprwnLWaMAEvYI9.jpg" target="_blank"><img src="/pic/media%2FFprwnLWaMAEvYI9.jpg%3Fname%3Dsmall%26format%3Dwebp" alt="" /></a></div></div></div>
                <p class="tweet-published">Feb 23, 2023 · 10:25 PM UTC</p>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span> 4</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span> 53</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span> 2</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 210</div></span>
                </div>
              </div></div></div>
          <div class="after-tweet thread-line">
            <div class="timeline-item ">
              <a class="tweet-link" href="/CraigHRowland/status/1628883830026412032#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/CraigHRowland"><img class="avatar round" src="/pic/profile_images%2F1533597714381803520%2F9-0dOYFp_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/CraigHRowland" title="Craig Rowland - Agentless Linux Security">Craig Rowland - Agentless Linux Security</a>
                        <a class="username" href="/CraigHRowland" title="@CraigHRowland">@CraigHRowland</a>
                      </div>
                      <span class="tweet-date"><a href="/CraigHRowland/status/1628883830026412032#m" title="Feb 23, 2023 · 10:25 PM UTC">Feb 23</a></span>
                    </div>
                  </div></div>
                <div class="tweet-content media-body" dir="auto">A tainted kernel can mean many things, but usually is the result of an external module that was loaded which is not part of the standard kernel build. This can be innocent like a video driver, or not so innocent kernel rootkit. 

<a href="https://www.kernel.org/doc/html/latest/admin-guide/tainted-kernels.html">kernel.org/doc/html/latest/a…</a></div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span> 1</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 8</div></span>
                </div>
              </div>
            </div>
            <div class="timeline-item ">
              <a class="tweet-link" href="/CraigHRowland/status/1628883832526213122#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/CraigHRowland"><img class="avatar round" src="/pic/profile_images%2F1533597714381803520%2F9-0dOYFp_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/CraigHRowland" title="Craig Rowland - Agentless Linux Security">Craig Rowland - Agentless Linux Security</a>
                        <a class="username" href="/CraigHRowland" title="@CraigHRowland">@CraigHRowland</a>
                      </div>
                      <span class="tweet-date"><a href="/CraigHRowland/status/1628883832526213122#m" title="Feb 23, 2023 · 10:25 PM UTC">Feb 23</a></span>
                    </div>
                  </div></div>
                <div class="tweet-content media-body" dir="auto">The first thing to look for is /proc/sys/kernel/tainted. A value of 0 means kernel is not tainted. Any other value means a tainted kernel. This shell script snippet will decode the values:

for i in $(seq 18); do echo $(($i-1)) $(($(cat /proc/sys/kernel/tainted)&gt;&gt;($i-1)&amp;1));done</div>
                <div class="attachments"><div class="gallery-row" style=""><div class="attachment image"><a class="still-image" href="/pic/orig/media%2FFprxVHKaAAAd-9E.jpg" target="_blank"><img src="/pic/media%2FFprxVHKaAAAd-9E.jpg%3Fname%3Dsmall%26format%3Dwebp" alt="" /></a></div></div></div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span> 1</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span> 1</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 9</div></span>
                </div>
              </div>
            </div>
            <div class="timeline-item ">
              <a class="tweet-link" href="/CraigHRowland/status/1628883835546107904#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/CraigHRowland"><img class="avatar round" src="/pic/profile_images%2F1533597714381803520%2F9-0dOYFp_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/CraigHRowland" title="Craig Rowland - Agentless Linux Security">Craig Rowland - Agentless Linux Security</a>
                        <a class="username" href="/CraigHRowland" title="@CraigHRowland">@CraigHRowland</a>
                      </div>
                      <span class="tweet-date"><a href="/CraigHRowland/status/1628883835546107904#m" title="Feb 23, 2023 · 10:25 PM UTC">Feb 23</a></span>
                    </div>
                  </div></div>
                <div class="tweet-content media-body" dir="auto">This system has tainted flags set for out-of-tree modules from Virtualbox. The kernel taint flags match the modules listing showing taint (O). This is the expected result. 

This command will show you all modules with taint values:

grep "(.*)" /proc/modules | awk '{print $0 }'</div>
                <div class="attachments"><div class="gallery-row" style=""><div class="attachment image"><a class="still-image" href="/pic/orig/media%2FFprxmmKagAAhm9R.jpg" target="_blank"><img src="/pic/media%2FFprxmmKagAAhm9R.jpg%3Fname%3Dsmall%26format%3Dwebp" alt="" /></a></div></div></div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span> 1</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 7</div></span>
                </div>
              </div>
            </div>
            <div class="timeline-item ">
              <a class="tweet-link" href="/CraigHRowland/status/1628883839992094720#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/CraigHRowland"><img class="avatar round" src="/pic/profile_images%2F1533597714381803520%2F9-0dOYFp_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/CraigHRowland" title="Craig Rowland - Agentless Linux Security">Craig Rowland - Agentless Linux Security</a>
                        <a class="username" href="/CraigHRowland" title="@CraigHRowland">@CraigHRowland</a>
                      </div>
                      <span class="tweet-date"><a href="/CraigHRowland/status/1628883839992094720#m" title="Feb 23, 2023 · 10:25 PM UTC">Feb 23</a></span>
                    </div>
                  </div></div>
                <div class="tweet-content media-body" dir="auto">This system has an active Linux Loadable Kernel Module (LKM) stealth rootkit. The LKM has hidden itself from /proc/modules, but the kernel still shows taint. Something is hiding if your systems do not normally load tainted modules.

grep "(.*)" /proc/modules | awk '{print $0 }'</div>
                <div class="attachments"><div class="gallery-row" style=""><div class="attachment image"><a class="still-image" href="/pic/orig/media%2FFprx7e1agAAuCu1.jpg" target="_blank"><img src="/pic/media%2FFprx7e1agAAuCu1.jpg%3Fname%3Dsmall%26format%3Dwebp" alt="" /></a></div></div></div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span> 2</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span> 1</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 6</div></span>
                </div>
              </div>
            </div>
            <div class="timeline-item ">
              <a class="tweet-link" href="/CraigHRowland/status/1628883843318181888#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/CraigHRowland"><img class="avatar round" src="/pic/profile_images%2F1533597714381803520%2F9-0dOYFp_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/CraigHRowland" title="Craig Rowland - Agentless Linux Security">Craig Rowland - Agentless Linux Security</a>
                        <a class="username" href="/CraigHRowland" title="@CraigHRowland">@CraigHRowland</a>
                      </div>
                      <span class="tweet-date"><a href="/CraigHRowland/status/1628883843318181888#m" title="Feb 23, 2023 · 10:25 PM UTC">Feb 23</a></span>
                    </div>
                  </div></div>
                <div class="tweet-content media-body" dir="auto">Kernel taint can be normal on systems with external modules, but if you know your Linux fleet does not load any modules that cause taint, it can indicate something is amiss. LKM rootkits leave behind inconsistencies that are easily spotted once you know where to look.</div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span> 1</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span> 1</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 7</div></span>
                </div>
              </div>
            </div>
            <div class="timeline-item thread-last ">
              <a class="tweet-link" href="/CraigHRowland/status/1628883845776039936#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/CraigHRowland"><img class="avatar round" src="/pic/profile_images%2F1533597714381803520%2F9-0dOYFp_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/CraigHRowland" title="Craig Rowland - Agentless Linux Security">Craig Rowland - Agentless Linux Security</a>
                        <a class="username" href="/CraigHRowland" title="@CraigHRowland">@CraigHRowland</a>
                      </div>
                      <span class="tweet-date"><a href="/CraigHRowland/status/1628883845776039936#m" title="Feb 23, 2023 · 10:25 PM UTC">Feb 23</a></span>
                    </div>
                  </div></div>
                <div class="tweet-content media-body" dir="auto">Finding rootkits by hand is useful for incident response, but if you want to automate it <a href="/SandflySecurity" title="Sandfly Security">@SandflySecurity</a> makes this very easy with our agentless detection for kernel taint inconsistencies.</div>
                <div class="attachments">
                  <div class="gallery-row" style="">
                    <div class="attachment image"><a class="still-image" href="/pic/orig/media%2FFprzKo8aYAADbR8.png" target="_blank"><img src="/pic/media%2FFprzKo8aYAADbR8.png%3Fname%3Dsmall%26format%3Dwebp" alt="" /></a></div>
                    <div class="attachment image"><a class="still-image" href="/pic/orig/media%2FFprzhhdagAERDp_.png" target="_blank"><img src="/pic/media%2FFprzhhdagAERDp_.png%3Fname%3Dsmall%26format%3Dwebp" alt="" /></a></div>
                  </div>
                  <div class="gallery-row" style="margin-top: .25em; "><div class="attachment image"><a class="still-image" href="/pic/orig/media%2FFprzxlEaYAAEqcB.jpg" target="_blank"><img src="/pic/media%2FFprzxlEaYAAEqcB.jpg%3Fname%3Dsmall%26format%3Dwebp" alt="" /></a></div></div>
                </div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span> 1</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 8</div></span>
                </div>
              </div>
            </div>
          </div>
        </div>
        <div id="r" class="replies">
          <div class="reply thread thread-line">
            <div class="timeline-item ">
              <a class="tweet-link" href="/timb_machine/status/1629229839818399746#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/timb_machine"><img class="avatar round" src="/pic/profile_images%2F68168727%2F2007061702-debconf_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/timb_machine" title="Tim Brown">Tim Brown</a>
                        <a class="username" href="/timb_machine" title="@timb_machine">@timb_machine</a>
                      </div>
                      <span class="tweet-date"><a href="/timb_machine/status/1629229839818399746#m" title="Feb 24, 2023 · 9:20 PM UTC">Feb 24</a></span>
                    </div>
                  </div></div>
                <div class="replying-to">Replying to <a href="/CraigHRowland">@CraigHRowland</a></div>
                <div class="tweet-content media-body" dir="auto">You know... you folks should really come hang on <a href="/MITREattack" title="ATT&CK">@MITREattack</a>'s <a href="/search?q=%23linux_attack">#linux_attack</a> Slack :P</div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span> 1</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 2</div></span>
                </div>
              </div>
            </div>
            <div class="timeline-item thread-last ">
              <a class="tweet-link" href="/CraigHRowland/status/1629241644397785089#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/CraigHRowland"><img class="avatar round" src="/pic/profile_images%2F1533597714381803520%2F9-0dOYFp_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/CraigHRowland" title="Craig Rowland - Agentless Linux Security">Craig Rowland - Agentless Linux Security</a>
                        <a class="username" href="/CraigHRowland" title="@CraigHRowland">@CraigHRowland</a>
                      </div>
                      <span class="tweet-date"><a href="/CraigHRowland/status/1629241644397785089#m" title="Feb 24, 2023 · 10:07 PM UTC">Feb 24</a></span>
                    </div>
                  </div></div>
                <div class="tweet-content media-body" dir="auto">I'll see what I can do.</div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 2</div></span>
                </div>
              </div>
            </div>
          </div>
          <div class="reply thread thread-line"><div class="timeline-item thread-last ">
              <a class="tweet-link" href="/_malwarez/status/1629226813682597888#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/_malwarez"><img class="avatar round" src="/pic/profile_images%2F1064928804571922432%2FCWQIJu8n_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/_malwarez" title="Able Archer">Able Archer</a>
                        <a class="username" href="/_malwarez" title="@_malwarez">@_malwarez</a>
                      </div>
                      <span class="tweet-date"><a href="/_malwarez/status/1629226813682597888#m" title="Feb 24, 2023 · 9:08 PM UTC">Feb 24</a></span>
                    </div>
                  </div></div>
                <div class="replying-to">Replying to <a href="/CraigHRowland">@CraigHRowland</a></div>
                <div class="tweet-content media-body" dir="auto">Thanks for sharing this! 
/proc/sys/kernel/tainted is new for me 🥳</div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 1</div></span>
                </div>
              </div>
            </div></div>
          <div class="reply thread thread-line"><div class="timeline-item thread-last ">
              <a class="tweet-link" href="/jprasojo/status/1629564097107988481#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/jprasojo"><img class="avatar round" src="/pic/profile_images%2F75303492%2Fserius_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/jprasojo" title="Ｌｉｎｔａｎｇ ＪＰ">Ｌｉｎｔａｎｇ ＪＰ</a>
                        <a class="username" href="/jprasojo" title="@jprasojo">@jprasojo</a>
                      </div>
                      <span class="tweet-date"><a href="/jprasojo/status/1629564097107988481#m" title="Feb 25, 2023 · 7:28 PM UTC">Feb 25</a></span>
                    </div>
                  </div></div>
                <div class="replying-to">Replying to <a href="/CraigHRowland">@CraigHRowland</a> <a href="/binaryz0ne">@binaryz0ne</a></div>
                <div class="tweet-content media-body" dir="auto">but what if the cat and the echo binary’s are also tainted?</div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span> 1</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 3</div></span>
                </div>
              </div>
            </div></div>
        </div>
        <div class="top-ref"><div class="icon-container"><a class="icon-down" title="" href="#m"></a></div></div>
      </div></div>
  </body>
</html>